Fix invalid LDAP filter for user ID with comma

The Keystone server would respond with a 500 error when configured
to use the LDAP identity backend and a request is made to get a
token for a user that has an ID with a comma. The response is like:

 Authorization Failed: An unexpected error prevented the server from
 fulfilling your request. {'desc': 'Bad search filter'} (HTTP 500)

This is because the user DN wasn't properly escaped in the filter
for the query to get the groups that the user is a member of.

Closes-Bug: #1302106

Change-Id: Ib4886e66af0e979fcf23a84bcd51b07034547cb9
Sanitizes authentication methods received in requests.

When a user authenticates against Identity V3 API, he can specify
multiple authentication methods. This patch removes duplicates, which
could have been used to achieve DoS attacks.

Closes-Bug: 1300274
(cherry picked from commit ef868ad92c00e23a4a5e9eb71e3e0bf5ae2fff0c)
Cherry-pick from https://review.openstack.org/#/c/84425/

Change-Id: I6e60324309baa094a5e54b012fb0fc528fea72ab
Bump stable/havana next version to 2013.2.4

Change-Id: I00712a03722302f159557df87864c057b00a9921
Merge "Fix invalid LDAP filter for user ID with comma" into stable/havana
Block delegation escalation of privilege

Forbids doing the following with either a trust
  or oauth based token:
  creating a trust
  approving a request_token
  listing request tokens

Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2
Closes-Bug:  1324592
Qpid: advance thru the list of brokers on reconnect

Sync 877f1cab328fe8a9f8214687ea7e1287862de87d from oslo-incubator's
stable/havana branch.

In Qpid implementation, when using multiple qpid_hosts, we don't want to
immediately retry failed connection for the same failed broker. This was not
the case in existing implementation though, where we've always attempted to
reconnect starting from the first broker in the list of candidates. So if the
first broker failed, we initiated reconnect to the same failed broker.

This change makes reconnect() implementation to select the next broker in the
list. This also means that non-failure reconnect attempts will also switch the
current broker. All in all, users should not rely on any particular order to
use brokers from the list, so this should not constitute an issue.

Change-Id: Ia148baa6e1ec632789ac3621c85173c2c16f3918
Partial-Bug: 1261631
Ensure that in v2 auth tenant_id matches trust

Previously if a trustee requests a trust scoped token for a project that
is different to the one in the trust, however the trustor has the
appropriate roles then a token would be issued.

Ensure that the trust that was given matches the project that was
specified in the scope.

(cherry picked from commit 1556faec2f65dba60584f0a9657d5b717a6ede3a)

Closes-Bug: #1331912
Change-Id: I00ad783bcb93cea9e5622965f81b91c80f4570cc
Ensure routing key is specified in the address for a direct producer

Porting this fix from oslo.messaging.  This fixes the impl_qpid.py
driver to allow it to work with the latest stable upstream QPID broker
(version 0.28).  See the Apache Qpid Jira bug
https://issues.apache.org/jira/browse/QPID-5557

Change-Id: If71f78e50f8a9b3acfd1e9d02c8271f17c4ebee7
Closes-Bug: #1300318
(cherry picked from commit a90f0c6cfc44bc3c3fecec2f3b7281902cd6ec19)
add stevedore for testing with Keystoneclient master

stable/* tests run with Keystoneclient master and stevedore
dependency was introduced by "Plugin loading from config objects"
https://github.com/openstack/python-keystoneclient/commit/5c91ede44768ebbb2fff12f9a7c93e63b9bbd56d

Change-Id: If70a4114d73c71a1304cce6e937b0048213e730f
Updated from global requirements

Change-Id: If802220bebc8f213322b21771f09bb15236a33b6
Merge "Ensure routing key is specified in the address for a direct producer" into stable/havana
Merge "Qpid: advance thru the list of brokers on reconnect" into stable/havana
Merge branch 'stable/havana' of https://github.com/openstack/keystone into cis-havana-staging